lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 19 Oct 2017 22:30:21 +0100
From: Kurtis Brown <kurtis@...tisebear.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] [RCE] TP-Link Remote Code Execution CVE-2017-13772

** Advisory Information

Title: TP-Link Remote Code Execution
Blog URL: https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/
Vendor: TP-Link
Date Published: 19/10/2017
CVE: CVE-2017-13772


** Vulnerability Summary

Numerous remote code execution paths were discovered in TP-Link's
WR940N home WiFi router. Valid credentials are required for this
attack path. It is possible for an authenticated attacker to obtain a
remote shell with root privileges.


** Details

There were multiple occurrences of strcpy being used in an unsafe
manner, resulting in a trivial buffer overflow condition. It is also
possible to cause a Denial of Service on the web service.

Using the ‘Diagnostic’ page, an attacker could utilise the built in
‘ping’ feature of the router to cause either; a Denial of Service
attack to crash the web server or exploit a buffer overflow condition
to obtain a remote root shell.


** Vendor Response

TP-Link have released a new version of the firmware thus mitigating
exploitation of this issue.


** Report Timeline

* Disclosed to vendor – 11/8/2017
* Response from vendor, request for initial advisory – 14/8/2017
* Initial advisory sent – 14/8/2017
* Beta patch sent for testing by vendor – 17/8/2017
* Patch confirmed to work, however other vulnerable locations were
identified, a second exploit was written to demonstrate this. Sent to
vendor – 17/8/2017
* Response by vendor, will look into the other vulnerable locations – 18/8/2017
* Second patch sent for testing by vendor – 25/8/17
* Patch confirmed to mitigate vulnerabilities (500+ calls to strcpy
removed) – 29/8/2017
* Patch released – 28/9/2017 (Only HW V5 US)

** Credit

This vulnerability was discovered by Tim Carrington, part of the Fidus
Information Security research team.


** References

https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/


** Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ